Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/ch0ks/hackarandas-claude-toolbeltWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/ch0ks/hackarandas-claude-toolbelt/security-semgrep-setup)<a href="https://agentmods.dev/commands/ch0ks/hackarandas-claude-toolbelt/security-semgrep-setup"><img src="https://agentmods.dev/badge/commands/ch0ks/hackarandas-claude-toolbelt/security-semgrep-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/ch0ks/hackarandas-claude-toolbelt/security-semgrep-setup"><img src="https://agentmods.dev/badge/commands/ch0ks/hackarandas-claude-toolbelt/security-semgrep-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01585 |
| Opus 5 | $0.00000 | $0.00792 |
| Sonnet 5 | $0.00000 | $0.00317 |
| Haiku 4.5 | $0.00000 | $0.00159 |
Grade A, and why
security-semgrep-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 245 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Check if Semgrep is installed and working. If not, install it using the best available method. Then log in to Semgrep Pro, enable the Pro engine, and run a local Pro scan in the current directory.
Step 1 — Check if Semgrep is Already Installed
semgrep --version 2>/dev/null
If this succeeds, print the version and skip to Step 3 (login check). If this fails, proceed to Step 2.
Step 2 — Install Semgrep
Try each method in order. Move to the next only if the current one fails.
Method 1 — Homebrew
# Check if brew is available
which brew 2>/dev/null
If brew is available:
brew install semgrep
If this succeeds, verify:
semgrep --version
Print: ✅ Semgrep installed via Homebrew and skip to Step 3.
If brew is not available or brew install fails, try Method 2.
Method 2 — pip (system)
# Check if python3 is available
which python3 2>/dev/null
If python3 is available:
python3 -m pip install semgrep
If this succeeds, verify:
semgrep --version
Print: ✅ Semgrep installed via pip and skip to Step 3.
If python3 is not available or pip install fails, try Method 3.
Method 3 — pip (user install)
python3 -m pip install --user semgrep
If this succeeds:
# Add user bin to PATH for this session if needed
export PATH="$PATH:$(python3 -m site --user-base)/bin"
semgrep --version
Print: ✅ Semgrep installed via pip --user
If this also fails, print the following and stop:
❌ Semgrep installation failed.
Tried:
1. brew install semgrep — brew not available or failed
2. python3 -m pip install semgrep — failed
3. python3 -m pip install --user — failed
Manual options (macOS): brew install semgrep
Manual options (Linux): pipx install semgrep
Manual options (any): npm install -g @semgrep/semgrep
Full docs: https://semgrep.dev/docs/getting-started/
Skipping Semgrep Pro setup. Run /security-semgrep-setup again after resolving the install issue.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 245 lines · 0 tokens per session scan A 05b45bbc705e
security-semgrep-setup is a command published in the GitHub repository ch0ks/hackarandas-claude-toolbelt (5 stars, last pushed 4mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,585 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
scope
Prepare a focused analysis scope for large codebases or monorepos using repomix. Creates a digestible snapshot of the target code for subsequent security analysis.
threats
Combines application understanding with systematic threat identification. First understands the application, then identifies what could go wrong.
propagate
When you find one vulnerability, search for the same pattern everywhere else. Developers often make the same mistake repeatedly.
mobile-audit
End-to-end mobile audit driver for Android targets. Most Android bug-bounty work involves a decompiled APK that's been split into two directories.
sinks
Search the codebase for dangerous functions that could lead to vulnerabilities. Optionally auto-discover logging patterns and sensitive data sources.
trace
Trace attacker-controlled input to a sink and document whether it is a verified vulnerability, a hotspot that still needs proof, or a false positive.